Vendor
GitLab
1,178 known vulnerabilities.
Products
GitLab 1,112
GitLab CE/EE 22
GitLab Community and Enterprise Editions 13
GitLab EE 10
GitLab Runner 6
GitLab AI Gateway 4
DAST 2
gitlab-vscode-extension 2
GitLab Community Edition 2
GitLab Enterprise Edition 2
gitlab-shell 2
GitLab DAST API scanner 1
GitLab Language Server 1
GitLab Pages 1
GitLab Community Edition and GitLab Enterprise Edition 1
GitLab VSCode Fork 1
Gitaly 1
DAST API scanner 1
Community Edition and Enterprise Edition 0
Community Edition, Enterprise Edition 0
Enterprise Edition 0
1,178 results · Feed
-
Medium 5.5
Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client app…
-
High 8.7CVE-2021-22242 EPSS 64%
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a…
-
Medium 6.6
Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impers…
-
Medium 5.0
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL …
-
Low 3.1
Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a rep…
-
Medium 4.3
Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/C…
-
Low 2.7
Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages i…
-
Medium 5.4
Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentr…
-
Medium 5.4
Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation…
-
Medium 4.3
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a us…
-
Medium 5.3
Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized us…
-
Medium 4.3
Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to …
-
Medium 6.5
A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to acces…
-
Medium 4.9
Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary a…
-
Medium 6.8CVE-2021-22238 EPSS 72%
An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS…
-
High 7.7
A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abus…
-
Low 3.1
Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE…
-
Critical 9.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions st…
-
High 8.7
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a st…
-
Medium 4.2
Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign o…
-
Medium 4.3
An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details
-
High 7.1
A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6…
-
Medium 4.7
Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross…
-
Medium 4.9
Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability …
-
Medium 6.1
A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker t…
-
Low 3.5
A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject acces…
-
Medium 6.1
Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feat…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 1…
-
Medium 6.5
Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in Git…
-
Low 3.5
HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE
-
Medium 5.9
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8. Under a special condition it wa…
-
High 7.7
A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recu…
-
Medium 6.8
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab a…
KEV Feb 18, 2026 -
Medium 6.5
A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker…
-
Medium 6.1
An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XS…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions startin…
-
Medium 4.4
All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all…
-
Medium 6.5
A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker…
-
High 8.8
A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to lea…
-
High 7.5
An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak informati…